Explainable Anomaly Detection via Multi-Stage Neural Network Training
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection systems, particularly autoencoders, face challenges in handling rich, heterogeneous data features and explaining detected anomalies, as they often rely on one-class learning with limited anomalous data, leading to inadequate performance in real-world applications.
Innovation Solution
A multi-stage training method for neural networks involving unsupervised learning with unlabeled data, followed by supervised learning with labeled data, and domain adaptation, using autoencoders with convolutional layers and classification models to detect and explain anomalies across different domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If one-class learning is used to train autoencoders on normal data only, then the system can detect anomalies using reconstruction loss, but it fails to properly handle rich context of real-world practical applications with multiple heterogeneous features
Solution Approach 1:
The patent segments the anomaly detection task into multiple specialized autoencoders, each trained on specific types of features (e.g., one for numerical features, one for categorical features, one for text features). This segmentation allows each autoencoder to specialize in handling particular feature types effectively, resolving the contradiction between adaptability to heterogeneous features and detection reliability.
Solution Approach 2:
The patent creates a universal anomaly detection system that combines multiple specialized autoencoders into an ensemble framework. This multi-functional system can process various types of features (numerical, categorical, text, time-series) through appropriate autoencoders and aggregate their results, achieving both high adaptability to different feature types and reliable anomaly detection across diverse real-world applications.
2Ease of manufacture
If autoencoders are trained only on normal non-anomalous data, then training is feasible with available data, but the system cannot provide information explaining reasons for detected anomalies
Solution Approach 1:
The patent performs preliminary action by training autoencoders on normal data to establish baseline reconstruction patterns before actual anomaly detection. During the detection phase, when anomalies are identified through reconstruction loss, the system then analyzes which features contributed most to the high loss, providing explanatory information about anomaly reasons. This two-stage approach maintains training feasibility while recovering explanatory information.
Solution Approach 2:
The patent introduces feature importance analysis as an intermediary mechanism between the autoencoder reconstruction process and anomaly explanation. By calculating which input features contribute most to reconstruction error through gradient-based methods or feature ablation, the system bridges the gap between simple reconstruction-based detection and comprehensive anomaly explanation, maintaining training simplicity while providing rich diagnostic information.
3Device complexity
If a single autoencoder is used for anomaly detection, then the system structure is simple, but it cannot analyze each feature of the input data to detect anomaly and provide explanation
Solution Approach 1:
The patent segments the single autoencoder into multiple specialized autoencoders, each responsible for specific feature types. This segmentation enables feature-level anomaly analysis by allowing each autoencoder to focus on its designated feature type, improving detection capability while maintaining manageable system complexity through modular architecture and clear division of labor.
Data Source
AI summary
The present disclosure provides an anomaly detector. The anomaly detector comprises an input interface configured to accept input data, a first neural network having an autoencoder architecture including an encoder trained to encode the input data and a decoder trained to decode the encoded input data to reconstruct the input data, and a loss estimator configured to compare a plurality of parts of the input data with corresponding plurality of parts of the reconstructed input data to determine a sequence of losses for different components of a reconstruction error. The anomaly detector further comprises a second neural network trained in a supervised manner to classify the sequence of losses to detect an anomaly to produce a result of anomaly detection including one or a combination of a type of the anomaly and a severity of the anomaly, and an output interface to render the result of anomaly detection.